PT-2023-12597 · Ibexa · Ibexa Dxp+3

Published 2021-03-11 · Updated 2025-03-05 · CVE-2021-46876

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions eZ Publish Ibexa Kernel versions prior to 7.5.15.1 eZ Platform versions 1.13, 2.5, and 3.2 Ibexa DXP and Ibexa Open Source version 3.3

Description An issue was discovered that allows the "/user/sessions" endpoint to be abused, enabling an attacker to determine if a given account exists. This can be achieved by analyzing differences in response data or response time from certain requests.

Recommendations For eZ Publish Ibexa Kernel versions prior to 7.5.15.1, update to version 7.5.15.1 or later. For eZ Platform versions 1.13, 2.5, and 3.2, update using Composer to receive the fix. For Ibexa DXP and Ibexa Open Source version 3.3, update using Composer to receive the fix. As a temporary workaround, consider restricting access to the "/user/sessions" endpoint to minimize the risk of exploitation.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2021-46876

GHSA-89P3-9J8C-FQH4

GHSA-GMRF-99GW-VVWJ

Affected Products

Ibexa Dxp

Ibexa Open Source

Ez Platform

Ez Publish Ibexa Kernel

References · 10

• https://github.com/ezsystems/ezpublish-kernel/commit/b496f073c3f03707d3531a6941dc098b84e3cbed · Patch
• https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-gmrf-99gw-vvwj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46876 · Security Note
• https://osv.dev/vulnerability/GHSA-gmrf-99gw-vvwj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46876 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-89p3-9j8c-fqh4 · Vendor Advisory
• https://github.com/ezsystems/ezpublish-kernel · Note
• https://packagist.org/packages/ezsystems/ezpublish-kernel · Note
• https://t.me/cvenotify/46075 · Telegram Post
• https://t.me/cvenotify/113575 · Telegram Post